The DOI matches its Crossref record; 222 of the 233 references it cites were found in a registry or an index.
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Open accessAbstract
As machine learning systems grow in scale, so do their training data requirements, forcing practitioners to automate and outsource the curation of training data in order to achieve state-of-the-art performance. The absence of trustworthy human supervision over the data collection process exposes organizations to security vulnerabilities; training data can be manipulated to control and degrade the downstream behaviors of learned models. The goal of this work is to systematically categorize and discuss a wide range of dataset vulnerabilities and exploits, approaches for defending against these threats, and an array of open problems in this space.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“The DoD CDAO Responsible AI Toolkit [14] focuses on ethical and operational considerations rather than cryptographic integrity.”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [14]
In the citing paper
“By integrating PQC-safe signatures, hybrid modes, provenance modeling, and continuous attestation, it addresses critical gaps in current AI assurance practices that existing governance frameworks-including the NIST AI RMF [5], NIST SSDF [6], and DoD CDAO Responsible AI Toolkit [14]-do not fill.”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [14]
In the citing paper
“To carry out these attacks, attackers need to have complete knowledge about the target WFL framework, including the number of participants, local training algorithm, aggregation protocol, and global model convergence process [51], [243].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [51]
Citations
Cites
Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.74 · Cited by 24,513
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Labaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,119
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 20,507
Auto-Encoding Variational Bayes
Kingma, D. P., & Welling, M. (2013) · arXiv · doi:10.48550/arxiv.1312.6114 · Cited by 20,067
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Overcoming catastrophic forgetting in neural networks
Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Desjardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., et al. (2017) · Proceedings of the National Academy of Sciences · doi:10.1073/pnas.1611835114 · Cited by 7,899
Extracting and composing robust features with denoising autoencoders
Vincent, P., Larochelle, H., Bengio, Y., & Manzagol, P.-A. (2008) · Proceedings of the 25th international conference on Machine learning - ICML '08 · doi:10.1145/1390156.1390294 · Cited by 7,436
Calibrating Noise to Sensitivity in Private Data Analysis
Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006) · Lecture Notes in Computer Science · doi:10.1007/11681878_14 · Cited by 7,272
Robust estimation of a location parameter
Huber, P. J. (1964) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177703732 · Cited by 7,228
Flagged first, then by citations
11 of the 233 references couldn’t be matched to a known paper.
Research works printed but not linked: 6
- Wakefield, 2016, Microsoft chatbot is taught to swear on Twitter
- Valiant, Learning disjunction of conjunctions, 560
- Mahloujifar, Learning under -tampering attacks, 572
- Radford, 2019, Language models are unsupervised multitask learners, OpenAI blog, 1
- 10.1137/17M1126680 · DOI
- Donoho, 1988, The, Ann. Statist., 16, 552
Cited by
Sorted by citations
Items 301–356 of 356
A Unified Framework for Backdoor Trigger Segmentation
Xue, D., Qian, S., & Xu, C. (2026) · IEEE Transactions on Image Processing · doi:10.1109/tip.2026.3666796
GAI & cybersecurity: Bi-visions
Taher, A. B., Fourati, L. C., & Ayed, S. (2026) · Computer Science Review · doi:10.1016/j.cosrev.2026.100940
Intrusion detection using ensemble learning and deep learning for IoT network security
Mastouri, R., & Mliki, H. (2026) · Information Security Journal A Global Perspective · doi:10.1080/19393555.2026.2632670
Adversarial Machine Learning: From Attack Surface to Defence Mechanism
Pourmehrani, H., Karimi, N., & Firouzi, F. (2026) · Springer eBooks · doi:10.1007/978-3-032-06286-4_9
Zhang, H., Zhao, Y., Cheng, G., & Zhou, Y. (2025) · International Conference on Cyber Resilience and Endogenous Safety & Security (CRESS) · doi:10.1109/cress68073.2025.11452523
Neural networks security under realistic scenario
Maho, T. (2023) · theses.fr (ABES) · doi:10.70675/690e25b2z1fb9z4d7fza6cbzcb09e2b773cf
Unequal Vulnerability: The Differential Impact of Label Flipping Attacks Across Classes
Zhao, P., Li, M., Jiao, P., Tang, H., & Wu, O. (2026) · International World Wide Web Conference (WWW) · doi:10.1145/3774904.3792713
CACTEE: Confidential Asset Certification using Trusted Execution Environments
Akkuş, İ. E., & Rimac, I. (2026) · Workshop on System Software for Trusted Execution (SysTEX) · doi:10.1145/3805690.3805734
Sharma, N., & Singh, U. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.6667554
Wang, W., Alam, M. M., & Wang, Y. (2025) · Artificial Intelligence and Cloud Computing Conference (AICCC) · doi:10.1145/3789982.3790038
Security Enhancement for Person Re-Identification Through Diffusion Driven Semantic Attacks
Du, K., Ma, B., Yang, M., Xu, J., & Li, X. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3689286
PVDI: Preserving Vital and Disrupting Irrelevant Latent Attentions for Robust Backdoor Defense
Chen, J., Chu, Q., Yuan, H., Gong, T., Zhang, K., Yu, N., Zhang, D., & Zhu, B. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3694657
Saud, N. B., Abdulgawad, K. E. A., Mansour, M., Mahlous, A. R., & Azar, A. T. (2026) · IEEE Access · doi:10.1109/access.2026.3695138
Cyber Resilience in IoT Networks Revisited: Frameworks, Mechanisms, and Future Directions
Darbandeh, F., Asghar, M. R., & Chen, L. (2026) · ACM Computing Surveys · doi:10.1145/3818682
Side-Channel Privacy Attacks on Energy-Efficient Mobile Agents: A Membership Inference Perspective
Ehsan, I., Niu, J., & Zhang, Y. (2026) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/3812836.3814743
Statistical Analysis of Combined Adversarial Attacks on Spam Detection Models
Ruiz, S. A., Vidal, M. T., & Reyes‐Ortiz, J. A. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-28393-1_27
Precise defense method against low-magnitude poisoning attack in industrial internet of things
Ran, Z., Yao, Y. K., Shan, Y., Li, W., Yang, W., & Hao, Y. (2026) · Expert Systems with Applications · doi:10.1016/j.eswa.2026.133244
Fairness and Poison Attack Detection in AI for Cybersecurity Systems: A Comprehensive Toolkit
Ramachandran, M. (2026) · Texts in computer science · doi:10.1007/978-3-032-25874-8_6
Global Governance and Collaborative Strategies for AI Cybersecurity
Ramachandran, M. (2026) · Texts in computer science · doi:10.1007/978-3-032-25874-8_7
Aji, J. O. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.6963865
Davey, G. (2026) · Advances in Artificial Intelligence and Robotics Research · doi:10.4236/airr.2026.22004
Alsirhani, A., Ali, S., Humayun, M., Sahito, S.-U.-R., & Alzahrani, M. S. (2026) · Neurocomputing · doi:10.1016/j.neucom.2026.134365
Auditing a Robotic System for the AI Act
Lucaj, L., Bok, F., & van der Smagt, P. (2026) · ACM Conference on Fairness, Accountability, and Transparency (FAccT) · doi:10.1145/3805689.3812223 · Cited by 1
Wairagade, A., & Brahmanwade, L. (2026) · IEEE Symposium on Computer Applications & Industrial Electronics (ISCAIE) · doi:10.1109/iscaie68866.2026.11576316
When Models Must Forget: Evaluating Machine Unlearning Algorithms for Data Privacy and Security
de Jesus, D. C. S., & Rocha, A. A. D. A. (2026) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc69287.2026.11579810
Xie, J., Liu, Y., Zhang, F., Li, D. C., Fu, X., & Zha, Z.-J. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3712043
AdaColor: An Adaptive Backdoor Attack with Dynamic Trigger Generation and Color Space Perturbation
Song, L., Guo, C., Wei, S., & Li, Y. (2026) · Communications in computer and information science · doi:10.1007/978-981-92-3548-3_31
Backdoor Risks in Personalized Federated Learning Under Practical Constraints
He, Y., Ye, Q., Hei, X., & Wang, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-3015-0_13
Hassan, A. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7315142
Training-Time Backdoor Sample Filtering via Loss and Uncertainty Dynamics
Mao, W., Zhang, X., Ke, Y., Han, J., Li, W., Cui, Y., Xiao, K., & Xu, G. (2026) · International Conference on Mechatronics, Robotics, and Artificial Intelligence (MRAI) · doi:10.1109/mrai70020.2026.11621182
BadDenoise: Backdoor attacks on self-supervised image denoising
Guo, J. H., Lin, Y., Jiang, M., Wang, J., Chen, C., Jiang, W., & Li, H. (2026) · Pattern Recognition · doi:10.1016/j.patcog.2026.114565
Li, W., Liu, Y., Chen, R., & Buyya, R. (2026) · Software Practice and Experience · doi:10.1002/spe.70098
Hidden Backdoor Attacks in AI-Enabled Smart Highway Monitoring Systems
Sangeetha, T. S., Jishnu, K. S., Nair, S. A., Krishnan, K., Shijukumar, P. S., & Madathil, N. T. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-2600-3465-1.ch005
Managing Security Risks in AI Deployment
Mudassir, N., Waris, A., & Shehzad, A. (2026) · Springer eBooks · doi:10.1007/978-981-92-0875-3_13
RoboChain: A Blockchain-Powered Decentralized Training Framework for General-Purpose Robots
Mu, J., Wang, K., & Liu, Q. (2025) · International Conference on Data Management and Computer Science (ICDMCS) · doi:10.1109/icdmcs69443.2025.00023
Kwon, H., & Baek, J.-W. (2026) · Neurocomputing · doi:10.1016/j.neucom.2026.134830
Artificial intelligence in medicine: An ethical and legal review
Schleidgen, S., & Friedrich, O. (2026) · European Journal of Internal Medicine · doi:10.1016/j.ejim.2026.107172
Hameed, S., Cui, X., Imran, N., Aurangzeb, K., & Abdul, W. (2026) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-026-01139-x
AI-enabled IoT mobile cloud security: trends and challenges
Annane, B., Cherbal, S., Zier, A., Louail, L., & Alti, A. (2026) · Cluster Computing · doi:10.1007/s10586-026-06527-6
Jiang, S., Yang, Z., Song, S., & Xiao, S. (2026) · International Conference on Applied Mathematics, Modelling and Intelligent Computing (CAMMIC) · doi:10.1145/3817124.3817181
Counterfactual incremental defense against poisoning attacks
Wang, H., & Kandah, F. I. (2026) · Knowledge-Based Systems · doi:10.1016/j.knosys.2026.116930
Poisoning Detection in Textual Datasets Using RNN and SVM with Federated Learning
Kotturu, A., Moh, M., & Moh, T.-S. (2025) · IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology (WI-IAT) · doi:10.1109/wi-iat67162.2025.00095
A bibliometric analysis of adversarial attacks and countermeasures in AI/ML cybersecurity
Yazdanjue, N., Itkonen, J., Niemelä, M., & Gandomi, A. H. (2026) · Elsevier eBooks · doi:10.1016/b978-0-443-28940-8.00007-5
Exploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A Survey
Holland, R., Pal, S., & Pan, L. (2026) · ACM Computing Surveys · doi:10.1145/3847107
Securing Federated Learning: a comprehensive survey on poisoning attacks and defense mechanisms
Shan, X., Zhang, J., Zhang, M., Yu, H., & Yang, Z. (2026) · The Knowledge Engineering Review · doi:10.48130/ker-0026-0014
On the Fragility of Contribution Evaluation in Federated Learning
Pejó, B., Frank, M., Varga, K., Veliczky, P., & Biczók, G. (2026) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml68715.2026.00019
Security and Privacy in Aquatic Acoustic Systems: A Review of ML/DL in Edge-Fog-Cloud
Sheeja Rani, S., & Aburukba, R. (2026) · International Symposium on Networks, Computers and Communications (ISNCC) · doi:10.1109/isncc70543.2026.11693833
Transferable Unrestricted Attacks via Holistic Inversion and Implicit Cross-Attention Regularization
Chen, Y., Li, K., Li, Y., Wu, D., Zhou, D., Gao, D., & Ju, Z. (2026) · IEEE Transactions on Automation Science and Engineering · doi:10.1109/tase.2026.3733131
Hussien, H. M., Ya, S. M., Udzir, N. I., Ninggal, M. I. H., Wafeeq, M. T., & Jawad, S. I. (2026) · Research Square · doi:10.21203/rs.3.rs-10503793/v1
Generative AI for Trustworthy and Compliant Cybersecurity in the Digital Landscape
Moremada, C., Zeydan, E., & Liyanage, M. (2026) · International Conference on Future and Intelligent Networking (FINE) · doi:10.1109/fine71157.2026.00020
Augustine, C., Nicholas, D., Yocelin, V. A., Tambunan, F. R., & Meiliana, M. (2026) · International Conference on ICT for Smart Society (ICISS) · doi:10.1109/iciss71466.2026.11715026
Manda, S., Pooranian, Z., Shojafar, M., & Martinelli, F. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-41330-7_11
Strategic Autonomy and Human Agency in the Age of Military Artificial Intelligence
de Socio, M. R., volta, G., & Merlo, A. (2025) · IEEE International Workshop on Technologies for Defense and Security (TechDefense) · doi:10.1109/techdefense67306.2025.11721001
Attacks During Training and Secret Backdoors in Systems That Detect Network Intrusions
Manju, A., Kingsly Stephen, R., & Rajan, V. V. (2026) · IGI Global eBooks · doi:10.4018/979-8-2600-0363-3.ch002
Xiao, W., Xu, S., Li, J., & Mou, J. (2026) · Electronic Markets · doi:10.1007/s12525-026-00939-3
Akkaya, A. E. (2026) · International Artificial Intelligence and Data Processing Symposium (IDAP) · doi:10.1109/idap71869.2026.11728194
Metadata
- Authors
- Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T.
- Affiliations
- University of Maryland, College Park (US)
- Massachusetts Institute of Technology (US)
- University of Illinois Urbana-Champaign (US)
- University of California, Berkeley (US)
- Massachusetts Institute of Technology, Cambridge, MA, USA
- Venue
- IEEE Transactions on Pattern Analysis and Machine Intelligence
- Published
- 2023-02-01
- Volume
- 45
- Issue
- 2
- Pages
- 1563-1580
- ISSN
- 0162-8828 (ISSN-L)
- 2160-9292
- 1939-3539
- OpenAlex
- W3117572899
- Cited by
- 362
- References
- 233
- Citations by year
- 2026: 76 · 2025: 91 · 2024: 78 · 2023: 66
- FWCI
- 21.63
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Transactions on Pattern Analysis and Machine Intelligence (publishedVersion)
- PubMed (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Funders
- Defense Advanced Research Projects Agency
- QED4RML
- D3M programs
- National Science Foundation (CCF-1910100, TWC-1409915, CCF-1553428, CNS-1815221, DMS-1912866)
- Amazon Research Award Program
- Berkeley DeepDrive
- Facebook PhD Fellowship
- ONR MURI Program
- Alfred P. Sloan Foundation
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- data poisoning, backdoor attacks, machine learning security, attack defense
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
